DeutschShown in its original language — a full translation is planned for a future version.
MediaWiki: Mehrere Schwachstellen ermöglichen Cross-Site Scripting
view advisory published 2024-01-14
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-23176US | — | — | ||
An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS. | ||||
| CVE-2024-23179US | medium6.1 | — | ||
An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses messag… | ||||
| CVE-2024-23178US | medium5.4 | — | ||
An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message. | ||||
| CVE-2024-23177US | medium6.1 | — | ||
An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameter. | ||||
| CVE-2024-23174US | medium5.4 | — | ||
An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-us… | ||||
| CVE-2024-23173US | medium6.1 | — | ||
An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via… | ||||
| CVE-2024-23172US | medium5.4 | — | ||
An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions… | ||||
| CVE-2024-23171US | medium5.4 | — | ||
An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page al… | ||||
02
references
External citations — patches, advisories, analysis.
- NIST Vulnerability Database vom 2024-01-14external
- NIST Vulnerability Database vom 2024-01-14external
- NIST Vulnerability Database vom 2024-01-14external
- NIST Vulnerability Database vom 2024-01-14external
- NIST Vulnerability Database vom 2024-01-14external
- NIST Vulnerability Database vom 2024-01-14external
- NIST Vulnerability Database vom 2024-01-14external
- WID-SEC-W-2024-0083 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan